--- libmalloc/libmalloc-67.40.1/src/malloc.c
+++ libmalloc/libmalloc-53.1.1/src/malloc.c
@@ -101,8 +101,8 @@
  * provided that when malloc_destroy_zone is called all prior operations on that
  * zone are complete and no further calls referencing that zone can be made.
  */
-int32_t malloc_num_zones = 0;
-int32_t malloc_num_zones_allocated = 0;
+unsigned malloc_num_zones = 0;
+unsigned malloc_num_zones_allocated = 0;
 malloc_zone_t **malloc_zones = 0;
 malloc_logger_t *malloc_logger = NULL;
 
@@ -239,23 +239,8 @@
 	__sync_fetch_and_add(pFRZCounter, 1); // Advance this counter -- our thread is in FRZ
 
 	unsigned		index;
-	int32_t			limit = *(volatile int32_t *)&malloc_num_zones;
-	malloc_zone_t		**zones = &malloc_zones[1];
-
-	// From this point on, FRZ is accessing the malloc_zones[] array without locking
-	// in order to avoid contention on common operations (such as non-default-zone free()).
-	// In order to ensure that this is actually safe to do, register/unregister take care
-	// to:
-	//
-	//   1. Register ensures that newly inserted pointers in malloc_zones[] are visible
-	//      when malloc_num_zones is incremented. At the moment, we're relying on that store
-	//      ordering to work without taking additional steps here to ensure load memory
-	//      ordering.
-	//
-	//   2. Unregister waits for all readers in FRZ to complete their iteration before it
-	//      returns from the unregister call (during which, even unregistered zone pointers
-	//      are still valid). It also ensures that all the pointers in the zones array are
-	//      valid until it returns, so that a stale value in limit is not dangerous.
+	unsigned		limit = malloc_num_zones;
+	malloc_zone_t	**zones = &malloc_zones[1];
 
 	for (index = 1; index < limit; ++index, ++zones) {
 		zone = *zones;
@@ -364,17 +349,7 @@
 		protect_size = malloc_num_zones_allocated * sizeof(malloc_zone_t *);
 		mprotect(malloc_zones, protect_size, PROT_READ | PROT_WRITE);
 	}
-
-	/* <rdar://problem/12871662> This store-increment needs to be visible in the correct
-	 * order to any threads in find_registered_zone, such that if the incremented value
-	 * in malloc_num_zones is visible then the pointer write before it must also be visible.
-	 *
-	 * While we could be slightly more efficent here with atomic ops the cleanest way to
-	 * ensure the proper store-release operation is performed is to use __sync... to update
-	 * malloc_num_zones.
-	 */
-	malloc_zones[malloc_num_zones] = zone;
-	__sync_fetch_and_add(&malloc_num_zones, 1);
+	malloc_zones[malloc_num_zones++] = zone;
 
 	/* Finally, now that the zone is registered, disallow write access to the
 	 * malloc_zones array */